Bug Bounty Spotlight: A Conversation with Robert Chen and Philip Papurt
GitHub’s bug bounty program, running since 2014, relies on outside researchers to help harden its products. To mark Cybersecurity Awareness Month, the GitHub Security Bug Bounty team interviewed two of its top contributors: Robert Chen (@chen-robert) and Philip Papurt (@ginkoid). Both were recently credited for vulnerabilities disclosed in two open-source projects: tar and @npm/cli/arborist.
From CTFs to Real-World Bugs
Chen’s interest in security started early, with high school competitions like CyberPatriot and CYBER QUEST, but he credits picoCTF (https://picoctf.org/) as the most formative experience. After years of CTF work, he shifted to real-world testing through HackerOne, finding that direct practice was the best way to translate theory into applicable skills.
Favorite Bug Classes
Chen is drawn to XS-Search vulnerabilities. He describes the class as fundamentally architectural, noting that while these bugs can carry real impact, they are frequently hard to remediate. That difficulty makes them a poor fit for most bounty programs. “You can’t just find the bug, you also need to show how to fix it,” he says.
Papurt, meanwhile, gravitates toward content security policy (CSP) bypasses. The breadth of ways a CSP can be subtly misconfigured keeps the work interesting. That line of research has had spillover effects: digging into a CSP issue from a CTF challenge led him to security bugs in Chromium (https://crbug.com/1115628).
Why GitHub?
For Chen, the appeal is straightforward: interesting targets, responsive triage, and substantial payouts. Papurt highlights the complexity of GitHub’s products, which rarely resemble ordinary CRUD applications. He calls out GitHub Codespaces as a particular focus, where he and Chen spent considerable time mapping its authentication flows and trying to pivot from the Codespaces VM.
Lessons From Researching GitHub
Chen says the biggest takeaway is to assume nothing—widely used software is not necessarily secure. He advises approaching a target without preconceptions, looking for unexpected interactions rather than common vulnerability classes. Papurt echoes that GitHub products rarely fall to generic web bugs; the meaningful finds require reading source code and understanding exactly how a service works internally.
Staying Current and Collaborating
Both researchers rely on Twitter for security news, following analysts who share deep technical writeups, with occasional dips into Hacker News and security-related subreddits. Collaboration, they agree, is a strong multiplier. Chen notes that different perspectives often surface angles a solo researcher would miss—the sum is greater than the parts. Papurt says bouncing ideas off a partner is especially useful when hunting for an exploit path or trying to beat a mitigation.
Advice for New Researchers
Chen warns against a scattershot approach—learning one bug class and throwing it at every site in sight. Instead, he suggests building deep knowledge of the subsystems underneath a target. For web apps, that might mean understanding site isolation and cookie behavior. Bugs live where interactions get complicated, and fundamentals make them easier to spot. Papurt agrees that automated scanners will not get a beginner far and recommends going deep on a particular product or vulnerability class that genuinely interests you.
